5.4.23. Vulnerabilities

The following vulnerabilities are fixed in this release.

See also RTI Connext Security Bulletins and Advisories for a complete list of vulnerabilities in RTI releases that have been published through the CVE® Program. That list may be more up-to-date.

5.4.23.1. [Critical] Potential stack buffer overflow in Connext applications when parsing an XML type

The stack may have been corrupted when parsing an XML type.

5.4.23.1.1. User Impact without Security

This vulnerability could have caused the following on any application using XML types:

5.4.23.1.2. User Impact with Security

This vulnerability could have caused the following on any application using XML types:

[RTI Issue ID CORE-14870]

5.4.23.2. [Critical] Potential stack buffer write overflow in license-managed Core Libraries when setting RTI_LICENSE_FILE environment variable

The stack may have been corrupted while loading the RTI_LICENSE_FILE environment variable.

5.4.23.2.1. User Impact without Security

This vulnerability could have caused the following on any application loading the license information through the RTI_LICENSE_FILE environment variable:

5.4.23.2.2. User Impact with Security

This vulnerability could have caused the following on any application loading the license information through the RTI_LICENSE_FILE environment variable:

[RTI Issue ID CORE-15310]

5.4.23.3. [Critical] Buffer write overflow while parsing malicious license file

An out-of-bounds write on the heap could occur while parsing a malicious license file.

5.4.23.3.1. User Impact without Security

A vulnerability in the Connext application could have resulted in the following:

  • Heap buffer overflow while parsing a malicious license file.

  • Exploitable by overwriting the license file on the file system with a malicious license file.

  • Potential impact on integrity and availability of Connext application.

  • CVSS Base Score: 7.1 HIGH

  • CVSS v3.1 Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

5.4.23.3.2. User Impact with Security

Same impact as “User Impact without Security” above.

[RTI Issue ID CORE-15145]

5.4.23.4. [Critical] Potential integer overflow in Connext applications on 32-bit systems when parsing XML files with very large number of default attributes or levels of nesting

The Core Libraries XML parser had a third-party dependency on Expat version 2.6.2, which is known to be affected by a number of publicly disclosed vulnerabilities. These vulnerabilities have been fixed by upgrading Expat to the latest stable version, 2.6.3. See the “What’s New” section in this document for more details.

The impact on Connext applications of using the previous version varied depending on your Connext application configuration:

5.4.23.4.1. User Impact without Security

  • Exploitable through a compromised local file system containing malicious XML/DTD files.

  • Remotely exploitable through malicious RTPS messages.

  • If exploited, impact ranged from denial of service to potentially arbitrary code execution.

  • CVSS v3.1 Score: 9.8 CRITICAL

  • CVSS v3.1 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

5.4.23.4.2. User Impact with Security

  • Exploitable through a compromised local file system containing malicious XML/DTD files.

  • If exploited, impact ranged from denial of service to potentially arbitrary code execution.

  • CVSS v3.1 Score: 8.4 HIGH

  • CVSS v3.1 Vector: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

[RTI Issue ID CORE-15121]